Bugzilla – Attachment 155929 Details for
Bug 34287
Patron's should not be able to ask for checkoutability for different patrons
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34287: Amend unit test
Bug-34287-Amend-unit-test.patch (text/plain), 3.42 KB, created by
Martin Renvoize (ashimema)
on 2023-09-20 12:48:54 UTC
(
hide
)
Description:
Bug 34287: Amend unit test
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2023-09-20 12:48:54 UTC
Size:
3.42 KB
patch
obsolete
>From 0d2b5d46415e1e9817a256b9afb38dfa7b6564a3 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Wed, 20 Sep 2023 13:47:19 +0100 >Subject: [PATCH] Bug 34287: Amend unit test > >This patch updates the unit test to confirm that checkout availability >should be restricted to the patron checking the availability options on >the public side. >--- > t/db_dependent/api/v1/checkouts.t | 29 ++++++++++++++++++++--------- > 1 file changed, 20 insertions(+), 9 deletions(-) > >diff --git a/t/db_dependent/api/v1/checkouts.t b/t/db_dependent/api/v1/checkouts.t >index 1d83f8916bf..6507c807cc6 100755 >--- a/t/db_dependent/api/v1/checkouts.t >+++ b/t/db_dependent/api/v1/checkouts.t >@@ -336,18 +336,28 @@ subtest 'get_availability' => sub { > %needsconfirmation = (); > > subtest 'public availability' => sub { >- plan tests => 18; >+ plan tests => 22; > >- # Available, Not authentication required >- $t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(200) >- ->json_is( '/blockers' => {} )->json_is( '/confirms' => {} )->json_is( '/warnings' => {} ) >+ # Authentication required >+ $t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(401); >+ >+ # Only allow availability lookup for self >+ $t->get_ok( >+ "//$userid:$password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id" >+ )->status_is(403); >+ >+ # All ok >+ $t->get_ok( >+ "//$unauth_userid:$unauth_password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id" >+ )->status_is(200)->json_is( '/blockers' => {} )->json_is( '/confirms' => {} )->json_is( '/warnings' => {} ) > ->json_has('/confirmation_token'); > > # Needs confirmation upgrade to blocker > %needsconfirmation = ( TOO_MANY => 1, ISSUED_TO_ANOTHER => 1 ); >- $t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(200) >- ->json_is( '/blockers' => { TOO_MANY => 1, ISSUED_TO_ANOTHER => 1 } )->json_is( '/confirms' => {} ) >- ->json_is( '/warnings' => {} )->json_has('/confirmation_token'); >+ $t->get_ok( >+ "//$unauth_userid:$unauth_password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id" >+ )->status_is(200)->json_is( '/blockers' => { TOO_MANY => 1, ISSUED_TO_ANOTHER => 1 } ) >+ ->json_is( '/confirms' => {} )->json_is( '/warnings' => {} )->json_has('/confirmation_token'); > %needsconfirmation = (); > > # Remove personal information from public endpoint >@@ -394,8 +404,9 @@ subtest 'get_availability' => sub { > ressurname => 'private', > item_notforloan => 'private' > ); >- $t->get_ok("/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id")->status_is(200) >- ->json_is( '/blockers' => {} )->json_is( '/confirms' => {} )->json_is( '/warnings' => {} ) >+ $t->get_ok( >+ "//$unauth_userid:$unauth_password@/api/v1/public/checkouts/availability?item_id=$item1_id&patron_id=$patron_id" >+ )->status_is(200)->json_is( '/blockers' => {} )->json_is( '/confirms' => {} )->json_is( '/warnings' => {} ) > ->json_has('/confirmation_token'); > %issuingimpossible = (); > %alerts = (); >-- >2.41.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34287
:
155544
|
155929
|
155930
|
158043
|
158044
|
158251
|
158252